mcp-defense · alpha

Kernel-native runtime defense for AI agents.

Every tool call your agent makes, gated by policy. Every downstream flow, joined by correlation ID. Every crown-jewel access, blocked before the MCP server ever sees the request. Zero agent code changes. Full cause chain in your SIEM the same second.

mcp-defense demo · flight recorder
$ mcp-defense demo

19:11:23.806  ALLOW    tc_c7nniklnna  filesystem   read_file       path=/workspace/main.py
└ flow 10.0.0.5:50001 → 1.2.3.4:443 PASS
19:11:24.806  DENY     tc_3lflzidubq  filesystem   read_file       path=/home/alice/.aws/credentials
↳ crown_jewel
19:11:26.207  APPROVE  tc_x66ww6mhdq  filesystem   read_file       path=/workspace/app/.env.local
↳ sensitive_path — operator approved on /dev/tty
19:11:26.906  ORPHAN   —              —            —               10.0.0.5:52001 → 5.6.7.8:443 DROP
↳ no_matching_session — egress without a tool call
19:11:27.507  DENY     tc_ljes3vkxhm  filesystem   fetch           url=https://evil.example.com/exfil
↳ archetype_no_network

2 allow · 2 deny · 1 approval · 1 orphan
Three outcomes, one policy

Observe. Allow. Deny.

Every tool call and every downstream flow passes through the same pipeline. Each resolves to one of three states — decided at kernel speed, joined by correlation ID, and recorded for audit.

▲ OBSERVE
24h baseline
--observe mode and the generic archetype log every tool call and flow without blocking. Use it to learn what normal looks like before flipping enforcement on.
▲ ALLOW
Policy passed
Archetype baseline matched, or the operator approved a REQUIRE_APPROVAL on /dev/tty. Tool call forwards byte-for-byte; downstream flows attach by correlation ID.
■ DENY
Blocked at the source
Crown jewel, archetype violation, or operator rejection. Tool call blocked before the MCP server sees the request. Agent gets a JSON-RPC error with the matched rule; your SIEM gets the full event.
Architecture

Three vantage points. One cause chain.

LLM guardrails see the prompt — not the tool calls that happen after. Network security sees the packets — not the tool call that asked for them. mcp-defense sits in three places at once and joins them on a single correlation ID.

MCP-DEFENSE — ARCHITECTURE v0.1 · 2026 primary flow event stream mcp-defense AI Agent Claude Code · Cursor · Codex 01 MCP Proxy stdio / SSE · cid tagging MCP Server filesystem · github · db tool_call forward observe · cid 02 Policy Engine allow · deny · approve decision 03 Correlation Layer tool_call ↔ flow ↔ process Kernel Events cgroup v2 · XDP · 5-tuple FlowEvent AgentActionEvent 04 Flight Recorder timeline · audit SIEM / SOC Splunk · Datadog · webhook JSONL
Built-in archetypes

One baseline per MCP server type.

A filesystem server has no business opening sockets. A GitHub server has no business reaching anywhere but api.github.com. Ship with sensible defaults; override in config/archetypes.yaml.

filesystem
File access under /workspace. No network. No spawn.
github
Egress to api.github.com:443 only. No file writes outside /tmp.
database
Connects to configured hosts and ports only. No external egress.
web-fetch
Broad HTTPS by design. No file writes outside /tmp. No spawn.
shell
Spawn allowed (it's the point). Network locked. Explicit opt-in.
code-execution
Sandboxed spawn. No network. Tmp-only filesystem.
generic
Unknown server — 24h observation, then enforce the learned baseline.
Crown jewels

The paths that mean you're already losing.

Agent-specific sensitive paths. Not your grandfather's /etc/shadow — the files a prompt-injected coding agent actually reaches for. Three tiers: CROWN denies, AUTH requires approval, CONFIG logs.

~/.ssh/id_*
~/.aws/credentials
~/.kube/config
/var/run/secrets/**
/proc/*/mem
~/.docker/config.json
~/.gitconfig
~/.npmrc · ~/.pypirc
.env · .env.local
/var/run/docker.sock
.github/workflows/**
package.json · Cargo.toml
CROWN — deny
AUTH — require approval
CONFIG — log
One path that might surprise you: CLAUDE.md — your agent's own instruction file. Writing to it is how a prompt injection persists across sessions — the agent reads its own corrupted instructions next time. Same story for AGENTS.md, .cursorrules, and .claude/.
Quick start

Five minutes, no agent code changes.

Install, see the demo, wrap one Claude Code MCP server. Full setup guide in docs/CLAUDE_CODE.md.

01 — Install
git clone https://github.com/jessfortemnaturae8717/mcp-defense
cd mcp-defense && make install
02 — See it run (no real MCP server needed)
make demo

Exercises every decision path in ~6 seconds. This is where the screenshot above comes from.

03 — Wrap a Claude Code MCP server
{
  "mcpServers": {
    "filesystem": {
      "command": "mcp-defense",
      "args": [
        "stdio",
        "--archetype", "filesystem",
        "--agent-id", "claude-code",
        "--",
        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/you/code"
      ]
    }
  }
}

Add --observe to log without blocking, --approval to prompt on /dev/tty for sensitive paths, --siem-splunk / --siem-webhook to fan events to SOC tooling.

Integrates with

Works with what you already run.

No agent changes. No custom rules. JSONL-on-a-FIFO for anyone shipping kernel events. Drop it between the agent and the MCP server; stream the output to your SIEM.

AI Agents
  • Claude Code
  • Claude Desktop
  • Cursor
  • Cline
  • Codex
  • Any MCP client (stdio or SSE)
MCP Servers
  • filesystem · github · fetch
  • postgres · mysql · mongo · redis
  • shell · code-execution · puppeteer
  • Custom servers via stdio or SSE
SIEM / Observability
  • Splunk HEC (native)
  • Datadog Logs (webhook)
  • Elasticsearch (webhook)
  • Any JSON webhook endpoint
Kernel Layer
  • ternaryphysics-llm-security (XDP)
  • bpf-inference (ternary NN engine)
  • cgroup v2 attribution
  • Custom producers via JSONL FIFO
Status · alpha

Built. Running. Shipping.

MVP complete plus post-MVP integrations. 102 tests passing. Early-access partners get first look at stable enforcement and drive the packaging roadmap.

Weeks 1–2 · done
MCP proxy (stdio + SSE) + policy engine.
Transparent forward, correlation-ID tagging, archetype baselines, crown-jewel matcher with glob support.
Weeks 3–4 · done
Correlation layer + flight recorder + demo.
Join tool calls to kernel flows by cgroup ID. Orphan-flow anomaly detection. Real-time styled timeline output.
Post-MVP · done
SIEM · interactive approval · kernel bridge · Claude Code setup guide.
Splunk HEC + webhook connectors with TeeActionSink fanout. /dev/tty approval prompt with session allow-list. JSONL bridge from ternaryphysics-llm-security XDP.
Next · in progress
Docker image · PyPI release · early-access partners.
Published container on GHCR. pip install mcp-defense. Partnering with 3–5 teams running AI coding agents in production.

Deploy an agent. Deploy its defender.

pip install mcp-defense. Or reach out if you're running Claude Code, Cursor, Cline, or Codex in production and want to talk about fleet policy, SSO, or an enterprise integration.

Get started Talk to us